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CLAIMS 

That which is claimed is: 

1 . A method of processing a packet, comprising: 

translating Internet Protocol (IP) addresses located in a pay load of the packet 
if at least one of a source address and a destination address located in a packet header has 
been previously translated. 

2. A method according to Claim 1 , wherein translating IP addresses is 
preceded by: 

receiving a packet at a network address translator (NAT) device; 

determining if at least one of the source address and the destination address located in 
the packet header has been previously translated to a normalized IP address; and 

searching the pay load of the packet for IP addresses if it is determined that at least one 
of the source address and the destination address located in the packet header has been 
previously translated; 

wherein translating IP addresses comprises replacing at least one occurrence of an IP 
address located in the pay load of the packet. 

3 . A method according to Claim 2, wherein determining if at least one of 
the source address and the destination address located in the packet has been previously 
translated comprises: 

identifying the source address and the destination address in the packet header; and 
determining if at least one of the source address and the destination address is present 

in a set of translation rules; 

wherein at least one of the source address and the destination address has been 

previously translated if it is determined that at least one of the source address and the 

destination address is present in a set of translation rules. 
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4. A method according to Claim 3, wherein searching the pay load of the 
packet for IP addresses comprises: 

identifying an occurrence of an IP address in the payload of the packet; 

determining a corresponding normalized IP address for the occurrence of the IP 
address using the set of translation rules that the at least one of the source address and the 
destination address was determined to be present in; and 

repeating the identifying and determining for each occurrence of an IP address in the 
payload; 

wherein translating IP addresses comprises replacing at least one occurrence of an IP 
address located in the payload of the packet with the corresponding normalized IP address. 

5. A method according to Claim 3, wherein determining if at least one of 
the source address and the destination address located in the packet has been previously 
translated further comprises: 

determining if at least one of the source address and the destination address is present 
in a header translation set of translation rules if it is determined that at least one of the source 
address and the destination address is present in the set of translation rules; 

wherein at least one of the source address and the destination address has been 
previously translated if it is determined that the source address and the destination address are 
not present in the header translation set of translation rules. 

6. A method according to Claim 5, further comprising: 

translating at least one of the source address and the destination address located in the 
packet header if it is determined that at least one of the source address and the destination 
address is present in the header translation set of translation rules. 

7. A method according to Claim 5, wherein determining a corresponding 
normalized IP address comprises determining a corresponding normalized IP address for the 
occurrence of the IP address using the header translation set of translation rules. 
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8. A method according to Claim 3, further comprising discarding the 

packet if it is determined that at least one of the source address and the destination address is 
5 not present in a set of translation rules and the source address and the destination address are 
not present in the header translation set of translation rules. 

9. A method according to Claim 3, wherein determining if at least one of 

the source address and the destination address is present in a set of translation rules further 
10 comprises: 

determining if at least one of the source address and the destination address is present 
in a plurality of sets of translation rules; and 

discarding the packet if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules. 

15 

10. A method according to Claim 9, wherein determining if at least one of 

the source address and the destination address is present in a set of translation rules further 
comprises: 

determining if one of the plurality of sets of translation rales is the header translation 
20 set of translation rales if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules; and 

discarding the packet if it is determined that one of the plurality of sets of translation 
rules is not the header translation set of translation rules. 

25 1 1 . A method according to Claim 3, wherein the set of translation rales 

comprises a list of each IP address that has been translated and a corresponding normalized IP 
address for each IP address that has been translated. 

12. A method according to Claim 1 1 , wherein the set of translation rules 
30 comprises a first set of translation rules that correspond to a first customer and a second set of 
translation rales that correspond to a second customer. 
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13. A method according to Claim 1 2, wherein the set of translation rules 

that correspond to the first customer are unique with respect to the set of translation rules that 
correspond to the second customer. 

14. A method according to Claim 1 , wherein the packet is a Simple 
Network Management Protocol (SNMP) packet. 

15. A method according to Claim 14, wherein each of the IP addresses are 
identified by a unique SNMP object identifier (OID) located within a Management 
Information Base(MIB). 

1 6. A method according to Claim 1 , wherein the at least one of the source 
address and the destination address located in the packet header is previously translated by a 
border firewall. 

17. A method according to Claim 1 , wherein the at least one of the source 
address and the destination address located in the packet header is previously translated by a 
router. 

18. A method of processing a packet, comprising: 

determining if at least one of a source address and a destination address located in a 
packet header is present in a set of translation rules; 

searching a payload of the packet for IP addresses if it is determined that at 
least one of a source address and a destination address is present in the set of translation 
rules; and 

translating the IP addresses in the payload of the packet using the set of translation 

rules. 

19. A method according to Claim 18, wherein determining if at least one 

of a source address and a destination address located in a packet header is present in a set of 
translation rules is preceded by receiving a packet at a network address translator (NAT) 
device. 
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20. A method according to Claim 1 8, wherein translating the IP addresses 
comprises replacing at least one occurrence of an IP address located in the pay load of the 
packet. 

21. A method according to Claim 1 8 , wherein determining if at least one 

of the source address and the destination address located in the packet header is present in a 
set of translation rules comprises: 

identifying the source address and the destination address in the packet header; 

scanning the set of translation rules to determine if at least one of the source address 
and the destination address is present in the set of translation rules; and 

determining if at least one of the source address and the destination address is present 
in a header translation set of translation rules if it is determined that at least one of the source 
address and the destination address is present in the set of translation rules; 

wherein at least one of the source address and the destination address has been 
previously translated if it is determined that at least one of the source address and the 
destination address is present in a set of translation rules and that the source address and the 
destination address are not present in the header translation set of translation rules. 

22. A method according to Claim 18, wherein searching the payload of the 
packet for IP addresses comprises: 

identifying an occurrence of an IP address in the payload of the packet; 

determining a corresponding normalized IP address for the occurrence of the IP 
address using the set of translation rules that the at least one of the source address and the 
destination address was determined to be present in; and 

repeating the identifying and determining for each occurrence of an IP address 
identified in the payload; 

wherein the translating IP addresses comprises replacing at least one occurrence of an 
IP address located in the payload of the packet with the corresponding normalized IP address. 

23 . A method according to Claim 22, further comprising: 
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translating at least one of the source address and the destination address located in the packet 
header if it is determined that at least one of the source address and the destination address is 
present in the header translation set of translation rules. 

5 24. A method according to Claim 23, wherein determining a corresponding 

normalized IP address comprises determining a corresponding normalized IP address for the 
occurrence of the IP addresses using the header translation set of translation rules. 

25. A method according to Claim 21, further comprising discarding the 

1 0 packet if it is determined that at least one of the source address and the destination address is 
not present in a set of translation rules and the source address and the destination address are 
not present in the header translation set of translation rules. 

26. A method according to Claim 1 8, wherein determining if at least one 

1 5 of the source address and the destination address is present in a set of translation rules further 
comprises: 

determining if at least one of the source address and the destination address is present 
in a plurality of sets of translation rules; 

determining if one of the plurality of sets of translation rules is the header translation 
20 set of translation rules if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules; and 

discarding the packet if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules and that one of the 
plurality of sets of translation rules is not the header translation set of translation rules. 

25 

27. A method according to Claim 1 8, wherein the set of translation rules 
comprises a list of each IP address that has been translated and a corresponding normalized IP 
address for each IP address that has been translated. 

30 28. A method according to Claim 1 6, wherein the set of translation rules 

comprises a first set of translation rules that correspond to a first customer and a second set of 
translation rules that correspond to a second customer. 

22 



RSW920010024US1 



Attorney Docket No. 5577-231 

29. A method according to Claim 28, wherein the set of translation rules 

that correspond to the first customer are unique with respect to the set of translation rules that 
correspond to the second customer. 

30. A method according to Claim 1 8, wherein the packet is a Simple 
Network Management Protocol (SNMP) packet. 

31. A method according to Claim 30, wherein each of the IP addresses are 
identified by a unique SNMP object identifier (OID) located within a Management 
Information Base (MIB). 

32. A method according to Claim 1 8, wherein the at least one of the source 
address and the destination address located in the packet header is previously translated by a 
border firewall. 

33 . A method according to Claim 18, wherein the at least one of the source 
address and the destination address located in the packet header is previously translated by a 
router. 

34. A system for processing a packet, comprising: 

a first network address translator (NAT) device that translates at least one of a 
source address and a destination address located in a packet header; and 

a second NAT device that translates Internet Protocol (IP) addresses located in 
a payload of the packet if at least one of the source address and the destination 
address has been previously translated by the first NAT device. 

35. A system according to Claim 34, wherein the second NAT device 
comprises: 

a detector circuit configured to determine if at least one of the source address and the 
destination address located in the packet header has been previously translated to a 
normalized IP address; and 
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a scanner circuit configured to search the payload of the packet for IP addresses if it is 
determined that at least one of the source address and the destination address located in the 
packet header has been previously translated; 

a payload translator circuit configured to translate IP addresses by replacing at least 
one occurrence of an IP address located in the payload of the packet. 

36. A system according to Claim 35, wherein the detector circuit is further 
configured to: 

identify the source address and the destination address in the packet header; 

determine if at least one of the source address and the destination address is present in 
a set of translation rules; and 

determine if at least one of the source address and the destination address is present in 
a header translation set of translation rules if it is determined that at least one of the source 
address and the destination address is present in the set of translation rules; 

wherein at least one of the source address and the destination address has been 
translated if it is determined that at least one of the source address and the destination address 
is present in a set of translation rules and that the source address and the destination address 
are not present in the header translation set of translation rules. 

37. A system according to Claim 35, wherein the scanner circuit is further 
configured to: 

identify an occurrence of an IP addresses in the payload of the packet; 

determine a corresponding normalized IP address for the occurrence of the IP 
addresses using the set of translation rules that the at least one of the source address and the 
destination address was determined to be present in; and 

repeat identifying and determining for each occurrence of an IP address identified in 
the payload; 

wherein translating IP addresses comprises replacing at least one occurrence of an IP 
address located in the payload of the packet with the corresponding normalized IP address. 

38. A system according to Claim 36, wherein the second NAT device 
further comprises: 
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a header translator circuit configured to translate at least one of the source address and 
the destination address located in the packet header if it is determined that at least one of the 
source address and the destination address is present in the header translation set of 
translation rules. 

39. A system according to Claim 38, wherein the scanner circuit is further 
configured to determine a corresponding normalized IP address for the occurrence of the IP 
address using the header translation set of translation rules. 

40. A system according to Claim 36, wherein the detector circuit is further 
configured to discard the packet if it is determined that at least one of the source address and 
the destination address is not present in a set of translation rules and that the source address 
and the destination address are not present in the header translation set of translation rules. 

41 . A system according to Claim 36, wherein the detector circuit is further 
configured to: 

determine if at least one of the source address and the destination address is present in 
a plurality of sets of translation rules; 

determine if one of the plurality of sets of translation rules is the header translation 
set of translation rules if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules; and 

discarding the packet if it is determined that at least one of the source address and the 
destination address is present in a plurality of sets of translation rules and that one of the 
plurality of sets of translation rules is not the header translation set of translation rules. 

42. A system according to Claim 36, wherein the set of translation rules 
comprises a list of each IP address that has been translated and a corresponding normalized IP 
address for each IP address that has been translated. 

43 . A system according to Claim 36, wherein the set of translation rules 
comprises a first set of translation rules that correspond to a first customer and a second set of 
translation rales that correspond to a second customer. 
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44. A system according to Claim 43, wherein the set of translation rules 

that correspond to the first customer are unique with respect to the set of translation rules that 
correspond to the second customer. 

45. A system according to Claim 34, wherein the packet is a Simple 
Network Management Protocol (SNMP) packet. 

46. A system according to Claim 45, wherein each of the IP addresses are 
identified by a unique SNMP object identifier (OID) located within a Management 
Information Base (MIB). 

47. A system according to Claim 34, wherein the first NAT device 
comprises a border firewall. 

48. A system according to Claim 34, wherein the first NAT device 
comprises a router. 

49. A system for processing a packet, comprising: 

means for translating Internet Protocol (IP) addresses located in a payload of 
the packet if at least one of a source address and a destination address located in a packet 
header has been previously translated. 

50. A system for processing a packet, comprising: 

means for determining if at least one of a source address and a destination address 
located in a packet header is present in a set of translation rules; 

means for searching a payload of the packet for IP addresses if it is determined 
that at least one of a source address and a destination address is present in the set of 
translation rules; and 

means for translating the IP addresses in the payload of the packet using the set of 
translation rules. 
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51. A computer program product for processing a packet, comprising: 

a computer readable program medium having computer readable program code 
embodied therein, the computer readable program code comprising: 

computer readable program code which translates Internet Protocol (IP) addresses 
5 located in a pay load of the packet if at least one of a source address and a destination address 
located in a packet header has been previously translated. 

52. A computer program product for processing a packet, comprising: 
a computer readable program medium having computer readable program 

1 0 code embodied therein, the computer readable program code comprising: 

computer readable program code which determines if at least one of a source address 
and a destination address located in a packet header is present in a set of translation rules; 

computer readable program code which searches a payload of the packet for IP 
addresses if it is determined that at least one of a source address and a destination address is 
15 present in the set of translation rules; and 

computer readable program code that translates the IP addresses in the payload of the 
packet using the set of translation rules. 
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